all spread attributes are treated as if they contain an unsa

Error message

all spread attributes are treated as if they contain an unsafe combination of props, unless specifically overridden by props after the last spread attribute prop.

What it means

Spread-attribute variant of oxlint's react/jsx-no-target-blank rule. When `warnOnSpreadAttributes: true` (off by default) is enabled and a target="_blank" element contains a spread (`{...props}`), the rule cannot see whether the spread injects an href, so it treats the element as unsafe: the diagnostic says all spread attributes are assumed to contain the unsafe combination unless explicitly overridden by props after the last spread.

Source

Thrown at crates/oxc_linter/src/rules/react/jsx_no_target_blank.rs:37

    context::{ContextHost, LintContext},
    rule::{DefaultRuleConfig, Rule},
    utils::is_same_expression,
};

fn target_blank_without_noreferrer(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Using target=`_blank` without rel=`noreferrer` (which implies rel=`noopener`) is a security risk in older browsers: see https://mathiasbynens.github.io/rel-noopener/#recommendations")
        .with_help("add rel=`noreferrer` to the element")
        .with_label(span)
}

fn target_blank_without_noopener(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("Using target=`_blank` without rel=`noreferrer` or rel=`noopener` (the former implies the latter and is preferred due to wider support) is a security risk: see https://mathiasbynens.github.io/rel-noopener/#recommendations")
        .with_help("add rel=`noreferrer` or rel=`noopener` to the element")
        .with_label(span)
}

fn explicit_props_in_spread_attributes(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn("all spread attributes are treated as if they contain an unsafe combination of props, unless specifically overridden by props after the last spread attribute prop.")
        .with_help("add rel=`noreferrer` to the element")
        .with_label(span)
}

#[derive(Debug, Clone, JsonSchema, Deserialize, Serialize)]
#[serde(rename_all = "camelCase", default, deny_unknown_fields)]
pub struct JsxNoTargetBlank {
    /// Whether to enforce dynamic links or enforce static links.
    enforce_dynamic_links: EnforceDynamicLinksEnum,
    /// Whether to warn when spread attributes are used.
    warn_on_spread_attributes: bool,
    /// Whether to allow referrers.
    allow_referrer: bool,
    /// Whether to check link elements.
    links: bool,
    /// Whether to check form elements.
    forms: bool,
}

View on GitHub (pinned to e1e7af627c)

Solutions

Add an explicit safe prop after the last spread: `<a target="_blank" {...rest} rel="noreferrer" />`.
Or specify the href explicitly after the spread so it is provably safe/relative.
If the component provably never receives external hrefs, disable `"warnOnSpreadAttributes"` or suppress inline for that element.

Example fix

// before
<a target="_blank" {...rest} />

// after
<a target="_blank" {...rest} rel="noreferrer" />

Defensive patterns

Strategy: validation

Validate before calling

oxlint --react-plugin -W no-target-blank=warn src/ # with warnOnSpreadAttributes enabled in config

Prevention

Put explicit rel/href AFTER the last {...spread} so the rule (and readers) see the final safe value.
In wrapper components, hoist the safety prop: `<a target={target} {...rest} rel="noreferrer" />`.
Only enable warnOnSpreadAttributes once; fix the flagged wrappers by adding trailing safe props.

When it happens

Trigger: `<a target="_blank" {...rest} />` with warnOnSpreadAttributes enabled: the spread resets the recorded target/rel state and forces href-valid=true, so unless a later explicit valid href or a valid rel attribute appears after the spread, `explicit_props_in_spread_attributes(spread_span)` is emitted. An explicit `rel="noreferrer"` (or valid href) placed after the spread suppresses it.

Common situations: Component libraries forwarding rest props (`<a {...rest} target="_blank" />`); wrappers around next/link or react-router anchors; teams that enabled warnOnSpreadAttributes during a security audit and hit dozens of wrapper components.

Related errors

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/f81fa13b6296ac6e. Report an issue: GitHub.